5d94b39fd34513a9d5d0968d89d961fc67a586ef016d158a4d82cebb2437c633

Analysis

max time kernel
140s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 22:43

Target

5d94b39fd34513a9d5d0968d89d961fc67a586ef016d158a4d82cebb2437c633.dll
Size

225KB
MD5

7bdd8fbaedca951a03e84242e97fc8f0
SHA1

66f19a90c486514b7a3b0e1778dc55b1208f0340
SHA256

5d94b39fd34513a9d5d0968d89d961fc67a586ef016d158a4d82cebb2437c633
SHA512

a4cd24a7aab12ec85d6ea27253f227888d1026857fd1d911a4da5517a5ed6dc234f9a4541f077195d3e8bd1208603dfb787e32af158df3370bb0d3115aec19f2
SSDEEP

3072:8TgIXAK7MMWWoRlahhRxN3i6Oni0JfUOd86dW/i15RdkHLpxMSr/rR5iGzjjI86:T4B7MMEArWDJfUG1hjMdmOQGnjF

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1496	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1496	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1496	1500	rundll32.exe	79
PID 1500 wrote to memory of 1496	1500	rundll32.exe	79
PID 1500 wrote to memory of 1496	1500	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d94b39fd34513a9d5d0968d89d961fc67a586ef016d158a4d82cebb2437c633.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d94b39fd34513a9d5d0968d89d961fc67a586ef016d158a4d82cebb2437c633.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of FindShellTrayWindow
  PID:1496

memory/1496-133-0x0000000074D00000-0x0000000074D3C000-memory.dmp

Filesize
240KB

Download
memory/1496-134-0x0000000074D00000-0x0000000074D3C000-memory.dmp

Filesize
240KB

Download
memory/1496-135-0x0000000074D00000-0x0000000074D3C000-memory.dmp

Filesize
240KB

Download
memory/1496-136-0x0000000074D00000-0x0000000074D3C000-memory.dmp

Filesize
240KB

Download
memory/1496-137-0x0000000074D00000-0x0000000074D29000-memory.dmp

Filesize
164KB

Download